Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe
-
Size
309KB
-
MD5
5fd0425eaa0775bfcdd5615637eab952
-
SHA1
06858f8a31bd339f0a9f872d35b23c02d64435e8
-
SHA256
6433d9ce6c60db4cf1fc329567d5433395053e798a6af085648440e8badafa17
-
SHA512
6ad0670627e0be08c2983b7b3515d066346f315bcf494bb187abeca1238c4f3f60ffabadbb02ff655a3d0b48d2863b162a10b6e31c968e8db28c4946f31532fa
-
SSDEEP
6144:q9RciFK2y6nl2KuSyJnuAQ0Fj6QiwqFauz1rMegOCTuRn:ORzFKmnl2KGnuAPFjdTqX1oZTk
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2928 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1284 lcotmrkb.exe -
Loads dropped DLL 3 IoCs
pid Process 2928 cmd.exe 2928 cmd.exe 1284 lcotmrkb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2992 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2260 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2992 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe 1284 lcotmrkb.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2928 2308 5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe 30 PID 2308 wrote to memory of 2928 2308 5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe 30 PID 2308 wrote to memory of 2928 2308 5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe 30 PID 2308 wrote to memory of 2928 2308 5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe 30 PID 2928 wrote to memory of 2992 2928 cmd.exe 32 PID 2928 wrote to memory of 2992 2928 cmd.exe 32 PID 2928 wrote to memory of 2992 2928 cmd.exe 32 PID 2928 wrote to memory of 2992 2928 cmd.exe 32 PID 2928 wrote to memory of 2260 2928 cmd.exe 34 PID 2928 wrote to memory of 2260 2928 cmd.exe 34 PID 2928 wrote to memory of 2260 2928 cmd.exe 34 PID 2928 wrote to memory of 2260 2928 cmd.exe 34 PID 2928 wrote to memory of 1284 2928 cmd.exe 35 PID 2928 wrote to memory of 1284 2928 cmd.exe 35 PID 2928 wrote to memory of 1284 2928 cmd.exe 35 PID 2928 wrote to memory of 1284 2928 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2308 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5fd0425eaa0775bfcdd5615637eab952_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\lcotmrkb.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 23083⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2260
-
-
C:\Users\Admin\AppData\Local\lcotmrkb.exeC:\Users\Admin\AppData\Local\lcotmrkb.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
309KB
MD55fd0425eaa0775bfcdd5615637eab952
SHA106858f8a31bd339f0a9f872d35b23c02d64435e8
SHA2566433d9ce6c60db4cf1fc329567d5433395053e798a6af085648440e8badafa17
SHA5126ad0670627e0be08c2983b7b3515d066346f315bcf494bb187abeca1238c4f3f60ffabadbb02ff655a3d0b48d2863b162a10b6e31c968e8db28c4946f31532fa